@dewtech/dare-cli 3.5.0 → 3.7.0

package/dist/hooks/__tests__/dispatcher.test.js

@@ -0,0 +1,69 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'fs-extra';
+import os from 'node:os';
+import path from 'node:path';
+import { dispatchHook, TrustRequiredError, ActionNotAllowedError, } from '../dispatcher.js';
+const spawnMock = vi.fn();
+vi.mock('../../exec/safe-spawn.js', () => ({
+    safeSpawn: (...args) => spawnMock(...args),
+}));
+describe('hooks dispatcher', () => {
+    let projectRoot;
+    beforeEach(async () => {
+        spawnMock.mockReset();
+        spawnMock.mockResolvedValue({ code: 0, stdout: '', stderr: '', timedOut: false });
+        projectRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'hook-dispatch-'));
+        await fs.writeJson(path.join(projectRoot, 'dare.config.json'), {
+            structure: 'mcp-server',
+            mcpLanguage: 'node-ts',
+        });
+        await fs.writeFile(path.join(projectRoot, 'dare-graph.yml'), 'backend: json\njson:\n  path: .dare/graph.json\n');
+    });
+    afterEach(async () => {
+        await fs.remove(projectRoot).catch(() => undefined);
+    });
+    it('rejects untrusted config without trustOverride', async () => {
+        await expect(dispatchHook({ on: { 'on-save': [{ action: 'lint' }] }, trusted: false }, { event: 'on-save' }, { projectRoot })).rejects.toThrow(TrustRequiredError);
+        expect(spawnMock).not.toHaveBeenCalled();
+    });
+    it('dispatches dare-review via safeSpawn with argv (shell:false path)', async () => {
+        const results = await dispatchHook({
+            on: { 'on-task-complete': [{ action: 'dare-review' }] },
+            trusted: true,
+        }, { event: 'on-task-complete', taskId: 'task-101' }, { projectRoot });
+        expect(spawnMock).toHaveBeenCalledTimes(1);
+        const [cmd, argv, opts] = spawnMock.mock.calls[0];
+        expect(cmd).toBe('dare');
+        expect(argv).toEqual(['review', 'task-101', '--strict', '--format', 'json']);
+        expect(opts).toMatchObject({ cwd: projectRoot, timeoutSeconds: 600 });
+        expect(results[0]).toMatchObject({
+            action: 'dare-review',
+            exitCode: 0,
+            skipped: false,
+            verdict: 'pass',
+        });
+    });
+    it('skips duplicate dispatch via idempotency', async () => {
+        const config = {
+            on: { 'on-save': [{ action: 'dare-validate' }] },
+            trusted: true,
+        };
+        const payload = { event: 'on-save' };
+        await dispatchHook(config, payload, { projectRoot });
+        const second = await dispatchHook(config, payload, { projectRoot });
+        expect(spawnMock).toHaveBeenCalledTimes(1);
+        expect(second[0]?.skipped).toBe(true);
+    });
+    it('rejects disallowed action keys at resolve time', async () => {
+        await expect(dispatchHook({
+            on: { 'on-save': [{ action: 'rm-rf' }] },
+            trusted: true,
+        }, { event: 'on-save' }, { projectRoot })).rejects.toThrow(ActionNotAllowedError);
+    });
+    it('returns empty array when no actions configured', async () => {
+        const results = await dispatchHook({ on: {}, trusted: true }, { event: 'pre-commit' }, { projectRoot });
+        expect(results).toEqual([]);
+        expect(spawnMock).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=dispatcher.test.js.map

package/dist/hooks/__tests__/dispatcher.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.test.js","sourceRoot":"","sources":["../../../src/hooks/__tests__/dispatcher.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAE1B,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;CACtD,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,SAAS,CAAC,SAAS,EAAE,CAAC;QACtB,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAElF,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE;YAC7D,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EACxC,kDAAkD,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,CACV,YAAY,CACV,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAC3D,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,EAAE,WAAW,EAAE,CAChB,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC;YACE,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE;YACvD,OAAO,EAAE,IAAI;SACd,EACD,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,EACjD,EAAE,WAAW,EAAE,CAChB,CAAC;QAEF,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC/B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,eAAwB,EAAE,CAAC,EAAE;YACzD,OAAO,EAAE,IAAI;SACd,CAAC;QACF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAkB,EAAE,CAAC;QAE9C,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAEpE,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,CACV,YAAY,CACV;YACE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAiB,EAAE,CAAC,EAAE;YAClD,OAAO,EAAE,IAAI;SACd,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,EAAE,WAAW,EAAE,CAChB,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EACzB,EAAE,KAAK,EAAE,YAAY,EAAE,EACvB,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hooks/__tests__/idempotency.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=idempotency.test.d.ts.map

package/dist/hooks/__tests__/idempotency.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.test.d.ts","sourceRoot":"","sources":["../../../src/hooks/__tests__/idempotency.test.ts"],"names":[],"mappings":""}

package/dist/hooks/__tests__/idempotency.test.js

@@ -0,0 +1,45 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'fs-extra';
+import os from 'node:os';
+import path from 'node:path';
+import { markSeen, shouldSkip, stateKey } from '../idempotency.js';
+describe('hooks idempotency', () => {
+    let projectRoot;
+    const ctx = () => ({
+        projectRoot,
+        statePath: '.dare/hooks-state.json',
+    });
+    beforeEach(async () => {
+        projectRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'hooks-idem-'));
+        await fs.ensureDir(path.join(projectRoot, '.dare'));
+    });
+    afterEach(async () => {
+        await fs.remove(projectRoot).catch(() => undefined);
+    });
+    it('skips after markSeen for same file event', async () => {
+        const payload = { event: 'on-save', file: 'src/a.ts' };
+        expect(await shouldSkip('on-save', 'lint', payload, ctx())).toBe(false);
+        await markSeen('on-save', 'lint', payload, ctx());
+        expect(await shouldSkip('on-save', 'lint', payload, ctx())).toBe(true);
+    });
+    it('does not skip for different files', async () => {
+        const a = { event: 'on-save', file: 'src/a.ts' };
+        const b = { event: 'on-save', file: 'src/b.ts' };
+        await markSeen('on-save', 'lint', a, ctx());
+        expect(await shouldSkip('on-save', 'lint', b, ctx())).toBe(false);
+    });
+    it('on-task-complete uses stable key regardless of file order', () => {
+        const payload = { event: 'on-task-complete', taskId: 'task-101' };
+        const k1 = stateKey('on-task-complete', 'dare-review', payload, {
+            touchedFiles: ['src/b.ts', 'src/a.ts'],
+        });
+        const k2 = stateKey('on-task-complete', 'dare-review', payload, {
+            touchedFiles: ['src/a.ts', 'src/b.ts'],
+        });
+        expect(k1).toBe(k2);
+    });
+    it('rejects unsafe paths', async () => {
+        await expect(shouldSkip('on-save', 'lint', { event: 'on-save', file: '../escape.ts' }, ctx())).rejects.toThrow();
+    });
+});
+//# sourceMappingURL=idempotency.test.js.map

package/dist/hooks/__tests__/idempotency.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.test.js","sourceRoot":"","sources":["../../../src/hooks/__tests__/idempotency.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEnE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAI,WAAmB,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;QACjB,WAAW;QACX,SAAS,EAAE,wBAAwB;KACpC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC1D,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,kBAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3E,MAAM,EAAE,GAAG,QAAQ,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE;YAC9D,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE;YAC9D,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,MAAM,CACV,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CACjF,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hooks/__tests__/telemetry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=telemetry.test.d.ts.map

package/dist/hooks/__tests__/telemetry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.test.d.ts","sourceRoot":"","sources":["../../../src/hooks/__tests__/telemetry.test.ts"],"names":[],"mappings":""}

package/dist/hooks/__tests__/telemetry.test.js

@@ -0,0 +1,52 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import os from 'node:os';
+import path from 'node:path';
+import { JsonGraph } from '../../graphrag/json-graph.js';
+import { recordHookTrigger } from '../telemetry.js';
+describe('hooks telemetry', () => {
+    let graph;
+    beforeEach(async () => {
+        const file = path.join(os.tmpdir(), `hook-tel-${Date.now()}.json`);
+        graph = new JsonGraph(file);
+        await graph.init();
+    });
+    afterEach(() => graph.close());
+    it('records hook node and triggered_by edge', () => {
+        recordHookTrigger(graph, {
+            event: 'on-save',
+            action: 'lint',
+            exitCode: 0,
+            skipped: false,
+            triggeredAt: '2026-06-07T12:00:00.000Z',
+        });
+        const edges = graph.getEdges('concept:hook:on-save:lint:2026-06-07T12:00:00.000Z', 'out');
+        expect(edges.some((e) => e.type === 'references' && e.metadata?.relation === 'triggered_by')).toBe(true);
+    });
+    it('records produced edge when verdict is present', () => {
+        recordHookTrigger(graph, {
+            event: 'on-task-complete',
+            action: 'dare-review',
+            exitCode: 0,
+            skipped: false,
+            verdict: 'pass',
+            triggeredAt: '2026-06-07T12:00:01.000Z',
+        });
+        const hookId = 'concept:hook:on-task-complete:dare-review:2026-06-07T12:00:01.000Z';
+        const edges = graph.getEdges(hookId, 'out');
+        expect(edges.some((e) => e.type === 'related_to' && e.metadata?.relation === 'produced')).toBe(true);
+    });
+    it('upserts without duplicating nodes on re-register', () => {
+        const record = {
+            event: 'pre-commit',
+            action: 'dare-validate',
+            exitCode: 0,
+            skipped: false,
+            triggeredAt: '2026-06-07T12:00:02.000Z',
+        };
+        recordHookTrigger(graph, record);
+        recordHookTrigger(graph, record);
+        const stats = graph.getStatistics();
+        expect(stats.totalNodes).toBeLessThanOrEqual(3);
+    });
+});
+//# sourceMappingURL=telemetry.test.js.map

package/dist/hooks/__tests__/telemetry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.test.js","sourceRoot":"","sources":["../../../src/hooks/__tests__/telemetry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,KAAgB,CAAC;IAErB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnE,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,iBAAiB,CAAC,KAAK,EAAE;YACvB,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,0BAA0B;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAChG,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,iBAAiB,CAAC,KAAK,EAAE;YACvB,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,0BAA0B;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,oEAAoE,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAC5F,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,YAAqB;YAC5B,MAAM,EAAE,eAAwB;YAChC,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,0BAA0B;SACxC,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hooks/allowlist.d.ts

@@ -0,0 +1,24 @@
+import type { HookEventPayload } from './types.js';
+/** Chaves FECHADAS de ação (A-3 / RS-01 / RS-06). Editável só via diff versionado. */
+export type AllowedActionKey = 'dare-validate' | 'dare-review' | 'graph-register' | 'lint' | 'test';
+/** Conjunto fechado materializado — fonte única para validação Zod (task-303). */
+export declare const ALLOWED_ACTION_KEYS: readonly AllowedActionKey[];
+export interface ResolvedCommand {
+    readonly cmd: string;
+    readonly argv: readonly string[];
+}
+/** Veredito de que a ação é "interna" (não spawna) — graph-register (RF-12). */
+export declare const INTERNAL_ACTIONS: readonly AllowedActionKey[];
+export declare class ActionNotAllowedError extends Error {
+    readonly code: "ACTION_NOT_ALLOWED";
+    constructor(key: string);
+}
+/**
+ * Resolve uma ação da allowlist para (cmd, argv). Único ponto que decide o que roda.
+ * Determinístico; payload entra como argv por elemento, nunca interpolado (RS-02).
+ */
+export declare function resolveAction(action: AllowedActionKey, payload: HookEventPayload, stack: {
+    lint?: string;
+    test?: string;
+}): ResolvedCommand;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/hooks/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../src/hooks/allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,MAAM,GACN,MAAM,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAMjD,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,SAAS,gBAAgB,EAAgC,CAAC;AAEzF,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBAClC,GAAG,EAAE,MAAM;CAIxB;AAWD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,eAAe,CA4BjB"}

package/dist/hooks/allowlist.js

@@ -0,0 +1,61 @@
+/** Conjunto fechado materializado — fonte única para validação Zod (task-303). */
+export const ALLOWED_ACTION_KEYS = [
+    'dare-validate',
+    'dare-review',
+    'graph-register',
+    'lint',
+    'test',
+];
+/** Veredito de que a ação é "interna" (não spawna) — graph-register (RF-12). */
+export const INTERNAL_ACTIONS = ['graph-register'];
+export class ActionNotAllowedError extends Error {
+    constructor(key) {
+        super(`Hook action '${key}' is not in the allowlist`);
+        this.code = 'ACTION_NOT_ALLOWED';
+        this.name = 'ActionNotAllowedError';
+    }
+}
+function splitStackCommand(command) {
+    const parts = command.trim().split(/\s+/).filter(Boolean);
+    if (parts.length === 0) {
+        throw new ActionNotAllowedError('lint/test (empty stack command)');
+    }
+    const [cmd, ...argv] = parts;
+    return { cmd: cmd, argv };
+}
+/**
+ * Resolve uma ação da allowlist para (cmd, argv). Único ponto que decide o que roda.
+ * Determinístico; payload entra como argv por elemento, nunca interpolado (RS-02).
+ */
+export function resolveAction(action, payload, stack) {
+    switch (action) {
+        case 'dare-validate':
+            return { cmd: 'dare', argv: ['validate', '--strict'] };
+        case 'dare-review': {
+            if (!payload.taskId) {
+                throw new ActionNotAllowedError('dare-review');
+            }
+            return {
+                cmd: 'dare',
+                argv: ['review', payload.taskId, '--strict', '--format', 'json'],
+            };
+        }
+        case 'graph-register':
+            return { cmd: '', argv: [] };
+        case 'lint': {
+            const cmd = stack.lint;
+            if (!cmd)
+                throw new ActionNotAllowedError('lint');
+            return splitStackCommand(cmd);
+        }
+        case 'test': {
+            const cmd = stack.test;
+            if (!cmd)
+                throw new ActionNotAllowedError('test');
+            return splitStackCommand(cmd);
+        }
+        default:
+            throw new ActionNotAllowedError(String(action));
+    }
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/hooks/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../src/hooks/allowlist.ts"],"names":[],"mappings":"AAUA,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,MAAM;IACN,MAAM;CACE,CAAC;AAOX,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAgC,CAAC,gBAAgB,CAAU,CAAC;AAEzF,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAE9C,YAAY,GAAW;QACrB,KAAK,CAAC,gBAAgB,GAAG,2BAA2B,CAAC,CAAC;QAF/C,SAAI,GAAG,oBAA6B,CAAC;QAG5C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,GAAI,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAwB,EACxB,OAAyB,EACzB,KAAuC;IAEvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACzD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD;YACE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/hooks/config.d.ts

@@ -0,0 +1,24 @@
+import type { HookConfig } from './types.js';
+export declare const HOOK_DEFAULTS: HookConfig;
+export declare class HookConfigError extends Error {
+    readonly issues: ReadonlyArray<{
+        path: string;
+        message: string;
+    }>;
+    constructor(issues: ReadonlyArray<{
+        path: string;
+        message: string;
+    }>);
+}
+/**
+ * Parse and validate `hooks` from an already-parsed dare.config.json object.
+ */
+export declare function parseHookConfig(raw: unknown): HookConfig;
+/** Serializable defaults for dare.config.json (new projects + migrations). */
+export declare function defaultHookConfigForProject(): HookConfig;
+/**
+ * Inserts the hooks block when absent (opt-in: trusted stays false).
+ * Returns true when the block was added.
+ */
+export declare function seedHooksDefaultsIfAbsent(cfg: Record<string, unknown>): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/hooks/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/hooks/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,eAAO,MAAM,aAAa,EAAE,UAAuC,CAAC;AAyBpE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAEtD,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAOrE;AAsBD;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAoBxD;AAED,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,UAAU,CAExD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,OAAO,CAIT"}

package/dist/hooks/config.js

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+import { assertRelativeSafe } from '../utils/path-safety.js';
+import { HOOK_EVENTS } from './types.js';
+import { ALLOWED_ACTION_KEYS } from './allowlist.js';
+export const HOOK_DEFAULTS = { on: {}, trusted: false };
+const hookEventEnum = z.enum(HOOK_EVENTS);
+const actionKeyEnum = z.enum(ALLOWED_ACTION_KEYS);
+const hookActionSchema = z
+    .object({
+    action: actionKeyEnum,
+    args: z.array(z.string()).optional(),
+})
+    .strict();
+const hookConfigSchema = z
+    .object({
+    on: z
+        .record(hookEventEnum, z.array(hookActionSchema))
+        .default({}),
+    trusted: z.boolean().default(false),
+})
+    .strict();
+export class HookConfigError extends Error {
+    constructor(issues) {
+        super(`Invalid hooks config: ${issues.map((i) => `${i.path}: ${i.message}`).join('; ')}`);
+        this.name = 'HookConfigError';
+        this.issues = issues;
+    }
+}
+function isHooksBlockAbsent(raw) {
+    if (raw === undefined || raw === null)
+        return true;
+    if (typeof raw !== 'object')
+        return false;
+    const rec = raw;
+    return !('hooks' in rec) || rec.hooks === undefined;
+}
+function zodIssues(error) {
+    return error.issues.map((issue) => ({
+        path: issue.path.length > 0 ? issue.path.join('.') : '(root)',
+        message: issue.message,
+    }));
+}
+function looksLikePath(arg) {
+    return arg.includes('/') || arg.includes('\\') || arg.includes('..');
+}
+/**
+ * Parse and validate `hooks` from an already-parsed dare.config.json object.
+ */
+export function parseHookConfig(raw) {
+    if (isHooksBlockAbsent(raw)) {
+        return { on: {}, trusted: false };
+    }
+    const block = raw.hooks;
+    const result = hookConfigSchema.safeParse(block);
+    if (!result.success) {
+        throw new HookConfigError(zodIssues(result.error));
+    }
+    for (const actions of Object.values(result.data.on)) {
+        for (const a of actions ?? []) {
+            for (const arg of a.args ?? []) {
+                if (looksLikePath(arg))
+                    assertRelativeSafe(arg);
+            }
+        }
+    }
+    return result.data;
+}
+/** Serializable defaults for dare.config.json (new projects + migrations). */
+export function defaultHookConfigForProject() {
+    return structuredClone(HOOK_DEFAULTS);
+}
+/**
+ * Inserts the hooks block when absent (opt-in: trusted stays false).
+ * Returns true when the block was added.
+ */
+export function seedHooksDefaultsIfAbsent(cfg) {
+    if (cfg.hooks !== undefined)
+        return false;
+    cfg.hooks = defaultHookConfigForProject();
+    return true;
+}
+//# sourceMappingURL=config.js.map

package/dist/hooks/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/hooks/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,CAAC,MAAM,aAAa,GAAe,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEpE,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAC1B,WAA+C,CAChD,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAC1B,mBAAuD,CACxD,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,MAAM,EAAE,aAAa;IACrB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;SAChD,OAAO,CAAC,EAAE,CAAC;IACd,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGxC,YAAY,MAAwD;QAClE,KAAK,CACH,yBAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,OAAO,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAChB,KAAiB;IAEjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAI,GAA+B,CAAC,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC/B,IAAI,aAAa,CAAC,GAAG,CAAC;oBAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAkB,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B;IACzC,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B;IAE5B,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,GAAG,CAAC,KAAK,GAAG,2BAA2B,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hooks/dispatcher.d.ts

@@ -0,0 +1,17 @@
+import { ActionNotAllowedError } from './allowlist.js';
+import { PathEscapeError } from '../utils/path-safety.js';
+import type { HookConfig, HookEventPayload, HookResult } from './types.js';
+export declare class TrustRequiredError extends Error {
+    readonly code: "TRUST_REQUIRED";
+    constructor(message?: string);
+}
+export declare class InvalidHookEventError extends Error {
+    readonly code: "INVALID_HOOK_EVENT";
+    constructor(event: string);
+}
+export declare function dispatchHook(config: HookConfig, payload: HookEventPayload, ctx: {
+    projectRoot: string;
+    trustOverride?: boolean;
+}): Promise<HookResult[]>;
+export { ActionNotAllowedError, PathEscapeError };
+//# sourceMappingURL=dispatcher.d.ts.map

package/dist/hooks/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/hooks/dispatcher.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,qBAAqB,EAEtB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAsB,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAa,MAAM,YAAY,CAAC;AAWtF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;gBAC9B,OAAO,SAAyC;CAI7D;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBAClC,KAAK,EAAE,MAAM;CAI1B;AAyDD,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACpD,OAAO,CAAC,UAAU,EAAE,CAAC,CAuGvB;AAED,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC"}

package/dist/hooks/dispatcher.js

@@ -0,0 +1,157 @@
+import pino from 'pino';
+import { safeSpawn } from '../exec/safe-spawn.js';
+import { resolveAction, ActionNotAllowedError, INTERNAL_ACTIONS, } from './allowlist.js';
+import { shouldSkip, markSeen } from './idempotency.js';
+import { recordHookTrigger } from './telemetry.js';
+import { assertRelativeSafe, PathEscapeError } from '../utils/path-safety.js';
+import { HOOK_EVENTS } from './types.js';
+import { gatesFor, resolveStackFromConfig, formatGateCommand, } from '../dag-runner/ralph-loop.js';
+import { createGraph, loadGraphConfig } from '../graphrag/index.js';
+const logger = pino({ level: process.env.DARE_HOOKS_LOG_LEVEL ?? 'info' });
+export class TrustRequiredError extends Error {
+    constructor(message = 'hooks are untrusted for this project') {
+        super(message);
+        this.code = 'TRUST_REQUIRED';
+        this.name = 'TrustRequiredError';
+    }
+}
+export class InvalidHookEventError extends Error {
+    constructor(event) {
+        super(`Invalid hook event: ${event}`);
+        this.code = 'INVALID_HOOK_EVENT';
+        this.name = 'InvalidHookEventError';
+    }
+}
+const TASK_ID_RE = /^task-[0-9a-z-]+$/;
+const VERDICT_ACTIONS = new Set([
+    'dare-validate',
+    'dare-review',
+    'lint',
+    'test',
+]);
+function isHookEvent(value) {
+    return HOOK_EVENTS.includes(value);
+}
+async function resolveHookStack(projectRoot) {
+    try {
+        const stack = await resolveStackFromConfig(projectRoot);
+        const gates = gatesFor(stack, projectRoot);
+        const lintGate = gates.find((g) => g.name === 'lint');
+        const testGate = gates.find((g) => g.name === 'test');
+        return {
+            lint: lintGate ? formatGateCommand(lintGate) : undefined,
+            test: testGate ? formatGateCommand(testGate) : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+async function withProjectGraph(projectRoot, fn) {
+    const config = await loadGraphConfig({ cwd: projectRoot });
+    const graph = await createGraph(config, { cwd: projectRoot });
+    try {
+        return await fn(graph);
+    }
+    finally {
+        await Promise.resolve(graph.close());
+    }
+}
+function verdictFor(action, exitCode) {
+    if (!VERDICT_ACTIONS.has(action))
+        return undefined;
+    return exitCode === 0 ? 'pass' : 'fail';
+}
+function isInternalAction(action) {
+    return INTERNAL_ACTIONS.includes(action);
+}
+export async function dispatchHook(config, payload, ctx) {
+    if (config.trusted !== true && ctx.trustOverride !== true) {
+        throw new TrustRequiredError();
+    }
+    if (!isHookEvent(payload.event)) {
+        throw new InvalidHookEventError(String(payload.event));
+    }
+    if (payload.file) {
+        try {
+            assertRelativeSafe(payload.file);
+        }
+        catch {
+            throw new PathEscapeError();
+        }
+    }
+    if (payload.taskId && !TASK_ID_RE.test(payload.taskId)) {
+        throw new Error(`Invalid taskId: ${payload.taskId}`);
+    }
+    const actions = config.on[payload.event] ?? [];
+    if (actions.length === 0) {
+        return [];
+    }
+    const stack = await resolveHookStack(ctx.projectRoot);
+    const results = [];
+    await withProjectGraph(ctx.projectRoot, async (graph) => {
+        for (const hookAction of actions) {
+            const action = hookAction.action;
+            const start = performance.now();
+            if (await shouldSkip(payload.event, action, payload, {
+                projectRoot: ctx.projectRoot,
+            })) {
+                const durationMs = Math.round(performance.now() - start);
+                results.push({
+                    event: payload.event,
+                    action,
+                    exitCode: 0,
+                    skipped: true,
+                    durationMs,
+                });
+                continue;
+            }
+            const { cmd, argv } = resolveAction(action, payload, stack);
+            const triggeredAt = new Date().toISOString();
+            let exitCode = 0;
+            let skipped = false;
+            if (isInternalAction(action)) {
+                recordHookTrigger(graph, {
+                    event: payload.event,
+                    action,
+                    exitCode: 0,
+                    skipped: false,
+                    triggeredAt,
+                });
+            }
+            else {
+                const res = await safeSpawn(cmd, [...argv, ...(hookAction.args ?? [])], {
+                    cwd: ctx.projectRoot,
+                    timeoutSeconds: 600,
+                });
+                exitCode = res.code;
+                const verdict = verdictFor(action, exitCode);
+                recordHookTrigger(graph, {
+                    event: payload.event,
+                    action,
+                    exitCode,
+                    skipped: false,
+                    verdict,
+                    triggeredAt,
+                });
+            }
+            await markSeen(payload.event, action, payload, {
+                projectRoot: ctx.projectRoot,
+            });
+            const durationMs = Math.round(performance.now() - start);
+            const verdict = verdictFor(action, exitCode);
+            logger.info({ event: payload.event, action, exitCode, durationMs, skipped }, 'hook dispatched');
+            results.push({
+                event: payload.event,
+                action,
+                exitCode,
+                skipped,
+                verdict,
+                durationMs,
+            });
+        }
+    });
+    return results;
+}
+export { ActionNotAllowedError, PathEscapeError };
+//# sourceMappingURL=dispatcher.js.map

package/dist/hooks/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/hooks/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGpE,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,EAAE,CAAC,CAAC;AAE3E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAE3C,YAAY,OAAO,GAAG,sCAAsC;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QAFR,SAAI,GAAG,gBAAyB,CAAC;QAGxC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAE9C,YAAY,KAAa;QACvB,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;QAF/B,SAAI,GAAG,oBAA6B,CAAC;QAG5C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC,MAAM,eAAe,GAAkC,IAAI,GAAG,CAAC;IAC7D,eAAe;IACf,aAAa;IACb,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YACxD,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,MAAwB,EACxB,QAAgB;IAEhB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwB;IAChD,OAAQ,gBAAgD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,OAAyB,EACzB,GAAqD;IAErD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,MAAM,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACtD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAEhC,IACE,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;gBAC/C,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC,EACF,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM;oBACN,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,IAAI;oBACb,UAAU;iBACX,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE;oBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM;oBACN,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,KAAK;oBACd,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE;oBACtE,GAAG,EAAE,GAAG,CAAC,WAAW;oBACpB,cAAc,EAAE,GAAG;iBACpB,CAAC,CAAC;gBACH,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC7C,iBAAiB,CAAC,KAAK,EAAE;oBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM;oBACN,QAAQ;oBACR,OAAO,EAAE,KAAK;oBACd,OAAO;oBACP,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;gBAC7C,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE7C,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,EAC/D,iBAAiB,CAClB,CAAC;YAEF,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM;gBACN,QAAQ;gBACR,OAAO;gBACP,OAAO;gBACP,UAAU;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC"}

package/dist/hooks/idempotency.d.ts

@@ -0,0 +1,14 @@
+import type { HookEvent, HookEventPayload } from './types.js';
+import type { AllowedActionKey } from './allowlist.js';
+export interface IdempotencyContext {
+    readonly projectRoot: string;
+    readonly statePath?: string;
+    /** For on-task-complete: touched files (sorted internally for hashing). */
+    readonly touchedFiles?: readonly string[];
+}
+export declare function stateKey(event: HookEvent, action: AllowedActionKey, payload: HookEventPayload, opts?: {
+    touchedFiles?: readonly string[];
+}): string;
+export declare function shouldSkip(event: HookEvent, action: AllowedActionKey, payload: HookEventPayload, ctx: IdempotencyContext): Promise<boolean>;
+export declare function markSeen(event: HookEvent, action: AllowedActionKey, payload: HookEventPayload, ctx: IdempotencyContext): Promise<void>;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/hooks/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/hooks/idempotency.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAyCD,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1C,MAAM,CAGR;AAiBD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf"}